contrast-agent 3.8.4

data/lib/contrast/components/config.rb

@@ -0,0 +1,135 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'contrast/utils/boolean_util'
+cs__scoped_require 'contrast/utils/env_configuration_item'
+cs__scoped_require 'contrast/configuration'
+
+module Contrast
+  module Components
+    # This component encapsulates reference to the configuration file.
+    # At the time of writing, the configuration file is a yaml file reflecting
+    # the 'common agent configuration' specification.
+    # 'Config' and 'configuration' are to be interpreted as referring
+    # specifically to these files and specifications, they are not generic
+    # terms for other avenues of user configuration.
+    #
+    # This component is responsible for...
+    #  - encapsulating file access & concomitant error conditions
+    #  - implementing validity checks with respect to the specification
+    #  - memoizing/streamline field accesses
+    #
+    # Config fails fast.  if it's not valid, the agent should break, and
+    # it should break LOUDLY.  Better to waste half an hour of the sysadmin's
+    # time than to silently fail to deliver functionality.
+    module Config
+      LOG_CONFIGURATION_DISABLED = 'Contrast disabled by configuration. Continuing without instrumentation.'
+      CONTRAST_ENV_MARKER        = 'CONTRAST__'
+
+      class Interface # :nodoc:
+        def initialize
+          build
+        end
+
+        def build log: true
+          @_valid = nil
+          @config = Contrast::Configuration.new
+          defaults
+          overrides
+          validate(log: log)
+        end
+        alias_method :rebuild, :build
+
+        # Prefer abstraction, but use #raw if you need.
+        # grep 'CONFIG.raw' for opportunities to refactor.
+        def raw
+          @config
+        end
+
+        def root
+          raw.root
+        end
+
+        def enabled?
+          Contrast::Utils::BooleanUtil.true?(raw.enable)
+        end
+
+        def disabled?
+          !enabled?
+        end
+
+        def protect?
+          Contrast::Utils::BooleanUtil.true?(raw.protect.enable)
+        end
+
+        def assess?
+          Contrast::Utils::BooleanUtil.true?(raw.assess.enable)
+        end
+
+        def session_id
+          @_session_id ||= begin
+                             s = raw.application.session_id || ''
+                             s.empty? ? nil : s
+                           end
+        end
+
+        def session_metadata
+          @_session_metadata ||= begin
+                                   s = raw.application.session_metadata || ''
+                                   s.empty? ? nil : s
+                                 end
+        end
+
+        def valid?
+          @_valid = validate(log: false) if @_valid.nil?
+        end
+
+        def invalid?
+          !valid?
+        end
+
+        private
+
+        SESSION_VARIABLES = "Invalid configuration. Setting both application.session_id and application.session_metadata is not allowed.\n"
+        def validate log: false
+          # The config has information about how to construct the logger.
+          # If the config is invalid, and you want to know about it, then
+          # you have a circular dependency if you try to log it,
+          # hence `log: false`.
+          if session_id && session_metadata
+            if log
+              cs__class.log_error(SESSION_VARIABLES)
+            else
+              puts SESSION_VARIABLES
+            end
+            return false
+          end
+
+          true
+        end
+
+        def defaults
+          raw.agent.service.host ||= Contrast::Configuration::DEFAULT_HOST
+          raw.agent.service.port ||= Contrast::Configuration::DEFAULT_PORT
+        end
+
+        def overrides
+          env_overrides
+        end
+
+        def env_overrides
+          # For env variables resembling CONTRAST__WHATEVER__NESTED_VALUE
+          # override raw.whatever.nested_value
+          ENV.each do |env_key, env_value|
+            next unless env_key.to_s.start_with?(CONTRAST_ENV_MARKER)
+
+            config_item = Contrast::Utils::EnvConfigurationItem.new(env_key, env_value)
+            raw.assign_value_to_path_array(config_item.dot_path_array, config_item.value)
+          end
+        end
+      end
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/components/contrast_service.rb

@@ -0,0 +1,113 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'monitor'
+
+module Contrast
+  module Components
+    module ContrastService
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Specifically, this allows for querying the state of the connection to
+      # the Service, as well as sending a message to the Service.
+      class Interface
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+
+        access_component :config, :agent
+
+        def update_received?
+          state.update_received?
+        end
+
+        def enabled?
+          state.service_enabled?
+        end
+
+        def unavailable?
+          !enabled?
+        end
+
+        def disabled?
+          state.service_forcibly_disabled?
+        end
+
+        def host
+          @_host ||= (CONFIG.root.agent.service.host || Contrast::Configuration::DEFAULT_HOST).to_s
+        end
+
+        def port
+          @_port ||= (CONFIG.root.agent.service.port || Contrast::Configuration::DEFAULT_PORT).to_i
+        end
+
+        def socket_path
+          @_socket_path ||= CONFIG.root.agent.service.socket
+        end
+
+        def logger_path
+          @_logger_path ||= CONFIG.root.agent.service.logger.path || DEFAULT_LOG_FILENAME
+        end
+
+        def use_tcp?
+          socket_path.nil?
+        end
+
+        def last_update
+          state.last_update
+        end
+
+        def use_bundled_service?
+          # Validates the config to decide if it's suitable for starting
+          # the bundled service
+          @_use_bundled_service ||= begin
+                                      # Requirement says "must be true" but that
+                                      # should be "must not be false" -- oops.
+                                      !false?(CONFIG.root.agent.start_bundled_service) &&
+                                          # Either a valid host or a valid socket
+                                          (CONFIG.root.agent.service.host.nil? ||
+                                          CONFIG.root.agent.service.host == 'localhost' ||
+                                          CONFIG.root.agent.service.host == '127.0.0.1' ||
+                                          CONFIG.root.agent.service.host.empty?) ||
+                                          # Path validity is the service's problem
+                                          !CONFIG.root.agent.service.socket.empty?
+                                    end
+        end
+
+        # TODO: As part of RUBY-356. Add new handling for SQL analysis via RPC (SPEED-211)
+
+        # The API for Agent to Service communication. These methods abstract away implementation
+        # details, responsibilities of sending messages to the service, and requirements mandated
+        # within the Agent<>SpeedRacer contract.
+
+        # Pushes a message onto a queue to later be consumed when the service sender thread is ready to
+        # handle it. The service response is not returned; rather, it is processed by the service sender
+        # thread. All messages sent to SpeedRacer should be queued rather than sent unless the calling method
+        # explicitly needs to act on the response object with custom logic (i.e. RequestContext#service_extract_response)
+        # @param msg [Contrast::Api::Dtm::Message] the message to be sent
+        def queue_message msg
+          return unless msg
+
+          Contrast::Utils::ServiceSenderUtil.push_to_ready_queue(msg)
+        end
+
+        # TODO: RUBY-662. Add additional check before we queue/send a message to see if we were unable
+        # to connect to the service.
+
+        # Bypass the queue and send the message directly to SpeedRacer. This is the only way
+        # to receive the response object back from SpeedRacer. An invoking method that needs
+        # to process the response object with custom logic should use this method.
+        #
+        # @param msg [Contrast::Api::Dtm::Message] the message to be sent
+        # @return [Array<Contrast::Api::Dtm::AttackResult>] the response from SpeedRacer
+        def send_message msg
+          return unless msg
+
+          state.client.send_to_speedracer(msg)
+        end
+      end
+
+      COMPONENT_INTERFACE = Interface.new
+    end
+  end
+end

data/lib/contrast/components/heap_dump.rb

@@ -0,0 +1,34 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Components
+    module HeapDump
+      # A wrapper build around the Common Agent Configuration project to allow
+      # for access of the values contained in its
+      # parent_configuration_spec.yaml.
+      # Specifically, this allows for querying the state of the Heap Dump
+      # utility.
+      module ClassMethods
+        include Contrast::Components::ComponentBase
+        include Contrast::Components::Interface
+
+        access_component :config
+
+        def heap_dump_enabled?
+          state.heap_dump_enabled?
+        end
+
+        def heap_dump_control
+          {
+              path: File.absolute_path(CONFIG.root.agent.heap_dump.path),
+              count: CONFIG.root.agent.heap_dump.count.to_i,
+              window: CONFIG.root.agent.heap_dump.window_ms.to_f / 1000,
+              delay: CONFIG.root.agent.heap_dump.delay_ms.to_f / 1000,
+              clean: true?(CONFIG.root.agent.heap_dump.clean)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/components/interface.rb

@@ -0,0 +1,178 @@
+# Copyright (c) 2020 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+cs__scoped_require 'delegate'
+cs__scoped_require 'contrast/core_extensions/module'
+cs__scoped_require 'contrast/utils/boolean_util'
+
+module Contrast
+  # This is the base module for our components classes. It is intended to
+  # facilitate the translation of the Common Configuration settings to usable
+  # Ruby methods. Any class under this namespace should be required here,
+  # providing a single point of require for this functionality.
+  module Components
+    # Include this into your classes and modules,
+    # and use 'access_component' to define constants that will allow
+    # interaction with other components.
+    module Interface
+      def self.included klass
+        # Upon inclusion, ComponentInterfaces extends the including with
+        # these two interfaces.
+        # Interface provides a class-level method 'access_component'
+        # that regulates per-class access to agent state.
+        # (It's a glorified `include MyComponent`).
+        klass.extend Contrast::Components::ComponentReceiverClassInterface
+      end
+    end
+
+    # All component access is gated through delegators.
+    #
+    # One delegator is used by the calling class,
+    # so we can tweak outgoing calls.
+    #
+    # The second delegator is used by the receiving component,
+    # so we can tweak incoming calls.
+    #
+    # We use __setobj__ to decide which component implementation to use.
+    # This is intended to provide flexibility in design and
+    # simplicity in testing.
+    class ComponentDelegator < SimpleDelegator
+      # intentionally left blank
+    end
+
+    # All components should inherit from this,
+    # whether Interfaces, InstanceMethods or ClassMethods.
+    module ComponentBase
+      def self.included klass
+        klass.extend  Methods
+        klass.include Methods
+      end
+
+      module Methods # :nodoc:
+        def false? config_param
+          Contrast::Utils::BooleanUtil.false?(config_param)
+        end
+
+        def true? config_param
+          Contrast::Utils::BooleanUtil.true?(config_param)
+        end
+
+        # TODO: RUBY-536
+        private
+
+        def _state_shim
+          Contrast::Agent::FeatureState.instance
+        end
+        alias_method :state, :_state_shim
+      end
+    end
+
+    def self.component_const_name mod_name
+      mod_name = mod_name.split('::').last
+      @cache ||= {}
+      @cache[mod_name] ||= mod_name. # CamelCaseName
+          split(/(?=[A-Z])/)&.          # ['Camel', 'Case', 'Name']
+          map(&:upcase)&.               # ['CAMEL', 'CASE', 'NAME']
+          join('_')                     # 'CAMEL_CASE_NAME'
+    end
+
+    # Interface to allow for iteration over each of the configuration
+    # components
+    module ComponentReceiverClassInterface
+      # Components are manually required at the end of
+      # this file, and this constant is then frozen.
+      # RUBY-535 to handle this better.
+      COMPONENT_MAP = {} # rubocop:disable Style/MutableConstant
+
+      # TODO: RUBY-535
+      # This module is used via `extend`, so it can't access
+      # constants we define here.
+      def component_map
+        COMPONENT_MAP
+      end
+
+      # .access_component
+      #
+      # to be used as:
+      #
+      # class Abc
+      #   include Contrast::Components::Interface
+      #   access_component :logger, :agent
+      #
+      #   def function
+      #     if AGENT.disabled?
+      #       0 / 3
+      #     end
+      #   rescue
+      #     logger.error "this function did error"
+      #   end
+      # end
+      #
+      # `:logger` creates a #logger and .logger method
+      # `:agent` provides an AGENT constant, analogous to a local singleton.
+      #
+      def access_component *component_set_syms
+        @_access_component ||= {}
+
+        component_set_syms.each do |sym|
+          next if @_access_component[sym]
+
+          if (mods = component_map[sym]) # rubocop:disable Style/GuardClause
+            # We may support multiple components via one access request.
+            mods.each do |m|
+              name = Contrast::Components.component_const_name(m.name)
+              cs__const_set(name, m::COMPONENT_INTERFACE) if m.cs__const_defined?(:COMPONENT_INTERFACE)
+              include m::InstanceMethods               if m.cs__const_defined?(:InstanceMethods, false)
+              extend  m::ClassMethods                  if m.cs__const_defined?(:ClassMethods, false)
+            end
+
+            @_access_component[sym] = true
+          else
+            raise NotImplementedError, "#{ self } asked to access undefined component '#{ sym }'."
+          end
+        end
+      end
+    end
+  end
+end
+
+# Components can depend on other components, but it should be a
+# directed acyclic graph.
+
+# Scope shouldn't depend on anything.
+cs__scoped_require 'contrast/components/scope'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:scope] = [Contrast::Components::Scope]
+
+# Config depends on Scope.
+cs__scoped_require 'contrast/components/config'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:config] = [Contrast::Components::Config]
+
+# Settings should not depend on anything but Config.
+cs__scoped_require 'contrast/components/settings'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:settings] = [Contrast::Components::Settings]
+
+cs__scoped_require 'contrast/components/agent'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:agent] = [Contrast::Components::Agent]
+
+cs__scoped_require 'contrast/components/app_context'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:app_context] = [Contrast::Components::AppContext]
+
+cs__scoped_require 'contrast/components/contrast_service'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:contrast_service] = [Contrast::Components::ContrastService]
+
+cs__scoped_require 'contrast/components/heap_dump'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:heap_dump] = [Contrast::Components::HeapDump]
+
+cs__scoped_require 'contrast/components/logger'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:logging] = [Contrast::Components::Logger]
+
+cs__scoped_require 'contrast/components/assess'
+cs__scoped_require 'contrast/components/protect'
+cs__scoped_require 'contrast/components/inventory'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:analysis] = [Contrast::Components::Protect,
+                                                                                   Contrast::Components::Assess,
+                                                                                   Contrast::Components::Inventory]
+cs__scoped_require 'contrast/components/sampling'
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP[:sampling] = [Contrast::Components::Sampling]
+
+Contrast::Components::ComponentReceiverClassInterface::COMPONENT_MAP.cs__freeze